- name: Install prerequisites
  apt:
    name:
      - apt-transport-https
      - ca-certificates
      - curl
      - gnupg
      - lsb-release
    state: present
    update_cache: yes

- name: Create keyrings directory
  file:
    path: /etc/apt/keyrings
    state: directory
    mode: '0755'

- name: Download Docker GPG key for Ubuntu
  get_url:
    url: https://download.docker.com/linux/ubuntu/gpg
    dest: /etc/apt/keyrings/docker.asc
    mode: '0644'
  when: ansible_distribution == "Ubuntu"

- name: Download Docker GPG key for Debian
  get_url:
    url: https://download.docker.com/linux/debian/gpg
    dest: /etc/apt/keyrings/docker.asc
    mode: '0644'
  when: ansible_distribution == "Debian"

- name: Add Docker repository for Ubuntu
  apt_repository:
    repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
    state: present
    filename: docker
  when: ansible_distribution == "Ubuntu"

- name: Add Docker repository for Debian
  apt_repository:
    repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable"
    state: present
    filename: docker
  when: ansible_distribution == "Debian"

- name: Install containerd
  apt:
    name: containerd.io
    state: present
    update_cache: yes

- name: Ensure containerd config dir
  file:
    path: /etc/containerd
    state: directory

- name: Generate default config
  shell: containerd config default > /etc/containerd/config.toml
  args:
    creates: /etc/containerd/config.toml

- name: Enable SystemdCgroup
  replace:
    path: /etc/containerd/config.toml
    regexp: 'SystemdCgroup = false'
    replace: 'SystemdCgroup = true'

- name: Remove disabled CRI plugin if present
  replace:
    path: /etc/containerd/config.toml
    regexp: '^\s*disabled_plugins\s*=\s*\[\s*"cri"\s*\]'
    replace: '# disabled_plugins = ["cri"]'

- name: Restart containerd
  systemd:
    name: containerd
    state: restarted
    enabled: yes